phalcon/cphalcon · error · Phalcon\Http\Cookie\Exceptions\CookieKeyTooShort

The cookie's key should be at least 32 characters long. Curr

Error message

The cookie's key should be at least 32 characters long. Current length is {length}.

What it means

Http\Cookie::assertSignKeyIsLongEnough() - reached via setSignKey() and the cookie constructor - rejects signing keys shorter than 32 characters (mb_strlen). The sign key is passed to crypt->encryptBase64($value, $signKey) to sign cookie values; Phalcon enforces a minimum length as a security margin and throws CookieKeyTooShort for anything weaker.

Source

Thrown at phalcon/Http/Cookie.zep:535

    {
        let this->useEncryption = useEncryption;

        return this;
    }

    /**
     * Assert the cookie's key is enough long.
     *
     * @throws \Phalcon\Http\Cookie\Exception
     */
    protected function assertSignKeyIsLongEnough( string signKey) -> void
    {
        var length;

        let length = mb_strlen(signKey);

        if unlikely length < 32 {
            throw new CookieKeyTooShort(length);
        }
    }

    /**
     * Check if the cookie is restored and restore it if not
     */
    private function checkRestored() -> void
    {
        if (true !== this->isRestored) {
            this->restore();
        }
    }

    /**
     * @phpstan-return http_setcookie_options
     */
    private function getCookieOptions(int expiresDefault) -> array
    {

View on GitHub (pinned to b7419de9cd)

Solutions

1. Generate and use a key of at least 32 characters, e.g. bin2hex(random_bytes(32)) (64 hex chars), stored in env/config
2. Rotate the existing cookie sign key to a long random value and update the service/config that supplies it
3. Pass null (or omit) the sign key if signing is not required - encryption then relies on the crypt service key

Example fix

// before
$cookie->setSignKey('4c1f9d32'); // 8 chars -> throws

// after
$cookie->setSignKey(bin2hex(random_bytes(32))); // 64 chars, >= 32 required

$key = (string) (getenv('COOKIE_SIGN_KEY') ?: '');
if (mb_strlen($key) < 32) {
    throw new \InvalidArgumentException('Cookie sign key must be >= 32 chars. Generate with bin2hex(random_bytes(32))');
}
$cookie->setSignKey($key);

try { $cookie->setSignKey($key); } catch (\Phalcon\Http\Cookie\Exceptions\CookieKeyTooShort $e) { // regenerate instead of padding
    $key = bin2hex(random_bytes(32));
    // persist new key, then retry once
}

When it happens

Trigger: Calling $cookie->setSignKey('shortkey') or constructing a Cookie with a sign key argument whose mb_strlen() is under 32 characters.

Common situations: Migrating from Phalcon 3/4 where no minimum length was enforced; reusing a legacy 16-character application secret as the cookie sign key; keys produced by weak generation methods (short hex, truncated hashes).

Related errors

• A dependency injection container is required to access the '
• Cannot set session name after a session has started
• The name contains non alphanum characters
• Configuration file {fileName} cannot be loaded
• Unknown method: [{method}]

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/1163d18d02eef9e6. Report an issue: GitHub.